DE102018203143A1 - A method of sending and method for checking at least two data blocks authenticated using a key - Google Patents

Abstract

The invention relates to a method for sending at least two data blocks (m, m) authenticated using a key, wherein a mapping function (f) is applied to the at least two data blocks (m, m) in order to obtain a target date (m), wherein an authentication function (s) is applied to the target date (m) in order to obtain an authenticator (MAC), wherein the authentication function (s) receives the key, the at least two data blocks (m, m) being in separate messages ( 111, 112) and the authenticator is sent in a message (113), and methods for checking at least two data blocks (m, m) authenticated using a key.

Description

The present invention relates to a method for sending and a method for checking at least two data blocks authenticated using a key as well as to a computing unit and a computer program for carrying them out.

State of the art

Ensuring the authenticity and integrity of messages is a common requirement in networked communication. For example, when communicating over a shared bus (eg, CAN, Controller Area Network) to which multiple subscribers are connected, it is intended to ensure that recipients of messages can determine who the sender of a received message is or whether the message is from a legitimate sender was sent and whether the message was changed during the transmission. This can be ruled out that messages are unauthorized introduced or manipulated, for example, by a controller on the CAN bus, which was compromised by an attacker.

Ensuring authenticity and integrity is commonly referred to as "message authentication".

For the automotive sector, message authentication via Secure Onboard Communication (SecOC) is specified as of AUTOSAR 4.2 [1]. In this case, messages are authenticated by means of a message authentication code ("MAC") calculated and sent by the sender based on the message, a freshness value (counter or timestamp against replay attacks) and a secret key every message is attached. The receiver can verify the authenticity of the message by recalculating the MAC (based on the same secret key) and comparing it with the transmitted value. Thus, unauthorized parties that do not have the secret key can not inject messages or manipulate them during transmission because they can not generate a valid MAC.

The problem with SecOC is the additional bandwidth requirement, which according to AUTOSAR recommendation per message is 24 bit MAC (shortened) + 8 bit counter (for synchronization). This leads to a significant reduction of the payload per message and thus to a greatly increased number of messages and the bandwidth requirement, especially for short message length protocols such as CAN. (In the case of 64-bit payload CAN messages, this is reduced by 50% to 32 bits by adding 24-bit MAC + 8-bit Freshness Value.)

Disclosure of the invention

According to the invention, a method for sending at least two data blocks authenticated using a key and a method for checking at least two data blocks authenticated using a key as well as a computer unit and a computer program for carrying them out with the features of the independent patent claims are proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

The invention is based on the idea of mutually authenticating not several individual but several message contents or data blocks and then sending the data blocks and the thus generated (common) authenticator (for example MAC or signature). This increases the payload per message and decouples the bandwidth overhead from the number of authenticated blocks of data. The invention is particularly advantageous for CAN, CAN FD, FlexRay and Ethernet messages.

According to one aspect of the invention, a plurality of data blocks to be transmitted, which contain payload data, such as e.g. Measured values, setpoints, commands, etc., are mapped by means of a mapping function into a target date for which an authenticator calculation takes place in accordance with an authentication function in which a key is received. The data blocks are then transmitted in separate messages, i. each data block is transmitted in a different message than any other of the data blocks. This advantageously results in that the entire message can be used for payload data. Also, the authenticator is transmitted, which can also be transmitted separately from the data blocks in a message or together with a data block in a message. In any case, only one message is required for authentication of multiple messages or message contents (data blocks). The payload loss can thereby be kept very low, in particular by selecting the number of data blocks which enter into the same mapping function and thus the same target date, for which a common authenticator is generated, the ratio of authentication data to user data is specifically influenced and in particular improved become.

Preferably, the target date is additionally sent in a message. This allows the Recipients of the message, the emergence of the authenticator particularly easy to understand.

According to an advantageous embodiment, the authenticator is sent together with the target date in a message. This thus leads to an embodiment in which a message contains both the target date and the authenticator authenticating the target date and thus represents a conventional authenticated message. In this way, the invention can also be implemented in existing authentication methods (for example AUTOSAR SecOC) and also lead there to an improvement of the user data authentication data ratio.

According to a preferred embodiment, the mapping function has a concatenation function. In particular, the target date is thus composed of the at least two data blocks strung together. This represents a particularly simple and easy-to-implement form of the mapping function, which improves the overall payload-authentication data ratio.

According to a particularly preferred embodiment, the mapping function has a spreading function (hash function), such as MD5, Secure Hash Algorithm (SHA), etc. When using a conventional scattering function sufficient collision security is created, so that still an authentication of the at least two data blocks with only one authenticator is possible, but now also the size of the target date can be reduced so that it in particular together with its associated generated authenticator can be transmitted in a common message (if necessary by shortening the target date, if the hash function used does not deliver a target date of suitable length). In this way, the invention can also be implemented in existing authentication methods with a predetermined message length (for example AUTOSAR SecOC) and also lead there to an improvement of the user data authentication data ratio.

Expediently, an actual value, such as a counter value or timestamp, additionally enters the authentication function. This measure also makes it possible to implement the invention in existing methods in which such an actual value is provided. Preferably, this actual value is then also sent in a message, in particular if this is required by the underlying transmission standard.

According to a preferred embodiment, the authenticator and / or the current value and / or the target date are shortened before sending. For example, only a predetermined and / or predeterminable number of bits, e.g. least significant bits, as described e.g. also possible according to AUTOSAR SecOC. Thus, a further improvement of the user data authentication data ratio is possible. In particular, if the target date is shortened before being sent, it will be truncated before the authentication function is used.

An arithmetic unit according to the invention, e.g. a network participant such as a control unit of a motor vehicle is, in particular programmatically, configured to perform a method according to the invention.

The implementation of the method in the form of a computer program is also advantageous, since this causes particularly low costs, in particular if an executing arithmetic unit is still used for further tasks and therefore exists anyway. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

The invention is illustrated schematically by means of embodiments in the drawing and will be described below with reference to the drawing.

list of figures

• 1 schematically shows a communication network with three participants according to a preferred embodiment of the invention.
• 2 schematically shows a method for sending at least two data blocks authenticated using a key and a method for checking the at least two data blocks authenticated using the key according to a first preferred embodiment.
• 3 schematically shows a method for sending at least two data blocks authenticated using a key and a method for checking the at least two data blocks authenticated using the key according to a second preferred embodiment.

Embodiment (s) of the invention

In 1 is schematically a section of a communication network 100 represented according to a preferred embodiment of the invention. The communication network 100 includes participants 101 . 102 . 103 on. The communication in the communication network 100 is message-based, ie the participants communicate with each other by exchanging individual messages or telegrams 111 . 112 . 113 , For example, the participant wants 101 with the participant 102 communicate and has the news 111 . 112 and 113 shipped.

For example, the communication network 100 designed as a CAN bus in a motor vehicle. For example, the participants 101 . 102 . 103 designed as control units, sensors or actuators.

Will the participant 101 safe (in the sense of authenticity and integrity) with the participant 102 communicate, he performs to a preferred embodiment of a method according to the invention.

The two participants 101 and 102 have a key 150 as well as over funds 160 for generating an actual value. At the keys 150 it may be the same (secret) key, as far as the authentication function is based on a symmetric cryptographic method, or a private and a public key, as far as the authentication function is based on an asymmetric cryptographic method. For example, instead of symmetric 'message authentication codes', an asymmetric signature-based method for authentication can be used analogously to AUTOSAR SecOC.

The means 160 To generate an actual value, it is possible in particular to be designed as a counter or as a clock, so that the actuality value is a count value or a time stamp.

In the event that the participant 101 securely or authenticate several (eg n) data blocks m ₁ , ..., _mn For example, to the participant 102 (or to several participants), two preferred variants are described below.

According to a first preferred embodiment, the subscriber applies 101 with reference to 2 a mapping function f in the form of a link function on the data blocks m ₁ , ..., _mn so that a target date m _Σ = f ( m ₁ , ..., _mn ), which is a link, for example stringing together m ₁ ... _mn representing individual data blocks.

Subsequently, the participant turns 101 an authentication function s to the target date to obtain an authenticator MAC ₁₀₁ = s (m _Σ ), wherein in the authentication function and the key 150 comes in, MAC ₁₀₁ = s (m _Σ , 150). Furthermore, according to the preferred embodiment described herein, an actuality value also enters the authentication function A ₁₀₁ one in the participant 101 from the media 160 for determining an actuality value, MAC ₁₀₁ = s (m _Σ , 150, A ₁₀₁ ). In particular, the authentication function may be a function for calculating a Message Authentication Code (MAC), for example AES-CMAC). In particular, the authentication function may compute the message authentication code analogously to AUTOSAR SecOC. However, the embodiment described herein has the advantage over AUTOSAR SecOC that the message authentication code indirectly includes all data blocks or message contents m ₁ , ..., _mn authenticated.

Then the participant ships 101 the data blocks m ₁ , ..., _mn in separate messages, eg 111 . 112 . 113 , ..., via the communication network 100 , The message authentication code MAC ₁₀₁ and the actual value A ₁₀₁ are also sent in a common message or in two separate messages. It can be provided that the message authentication code MAC ₁₀₁ and / or the actuality value A ₁₀₁ together with one of the data blocks m ₁ , ..., _mn be sent in a common message. It may further be provided that the message authentication code MAC ₁₀₁ and / or the actuality value A ₁₀₁ be shortened before sending, so that, for example, only a number of least significant bits is sent. It is understood that the number does not have to be the same.

For example, according to an embodiment corresponding to AUTOSAR SecOC, the update value is for synchronization only in case of packet loss and can be shortened. In this case, only the least significant bits are transmitted and used to adjust the complete update value at the receiver, if necessary.

The one or more recipients (here participants 102 ) receive the sent messages and can use them to create the data blocks m ₁ , ..., _mn , the (possibly abbreviated) message authentication code MAC ₁₀₁ and the (possibly abbreviated) actuality value A ₁₀₁ win.

Subsequently, the participant turns 102 in an analogous way to generating the mapping function f on the data blocks m ₁ , ..., _mn to a check-target date m _Σ and the authentication function s to the target date to receive a check authenticator or check message authentication code MAC ₁₀₂ to obtain. Is the message authentication code MAC ₁₀₁ shortened before sending, also shortens the participant 102 the calculated check message authentication code MAC ₁₀₂ in the same way.

Voices the check message authentication code thus calculated MAC ₁₀₂ and the received message authentication code MAC ₁₀₁ match, the data blocks m ₁ , ..., _mn further processed. If the check fails, the data blocks are detected as invalid and discarded, for example.

The embodiment just described is a preferred embodiment of the invention, but would require changes to the AUTOSAR PDU router or implementation as a "Complex Device Driver" for implementation in AUTOSAR and is not compliant with SecOC after AUTOSAR.

To solve this problem is described below with reference to 3 A further preferred embodiment of the invention is described, which differs from the above preferred embodiment in particular by the mapping function and the message containing the authenticator or message authentication code.

According to the second preferred embodiment, the subscriber applies 101 a mapping function f ' in the form of a scatter function (hash function), in particular a cryptographic hash function, such as from the MD or SHA family, on the data blocks m ₁ , ..., _mn so that a target date m _Σ101 = f '( m ₁ , ..., _mn ).

The subsequent application of the authentication function corresponds to that already described above. However, it may be provided at this point that the target date m _Σ101 before using the authentication function s is shortened so that it can be transmitted in an authenticated message. For example, in the case described, this may be a 64-bit CAN message, the target date m _Σ101 be truncated to 32 bits prior to the application of the authentication function, which is the length of the remaining payload using Secure Communication with 24-bit MAC and 8-bit "Freshness Value".

Then the participant ships 101 the data blocks m ₁ , ..., _mn in separate messages, eg 111 . 112 . 113 , ..., via the communication network 100 , Furthermore, the participant ships 101 the target date m _Σ101 and its associated message authentication code MAC ₁₀₁ and optionally the actual value A ₁₀₁ in a common message, which thus corresponds to a conventional authenticated message, for example according to AUTOSAR SecOC.

The one or more recipients (here participants 102 ) receive the sent messages and can use them to create the data blocks m ₁ , ..., _mn , the (possibly abbreviated) message authentication code MAC ₁₀₁ , the (possibly abbreviated) actuality value A ₁₀₁ and the (possibly shortened) target date m _Σ101 win.

Subsequently, the participant checks 102 the authenticity of the authenticated message, ie it checks the target date m _Σ101 based on the associated message authentication code MAC ₁₀₁ ,

For a symmetric authentication function, the subscriber applies 102 for example, in an analogous manner to generating the authentication function s on the received target date m _Σ101 to a test authenticator or a test message authentication code MAC ₁₀₂ to obtain.

Is the message authentication code MAC ₁₀₁ shortened before sending, also shortens the participant 102 the calculated check message authentication code MAC ₁₀₂ in the same way.

Voices the check message authentication code thus calculated MAC ₁₀₂ and the received message authentication code MAC ₁₀₁ do not match, the data blocks m ₁ , ..., _mn recognized as invalid and in particular discarded. Voices the check message authentication code thus calculated MAC ₁₀₂ and the received message authentication code MAC ₁₀₁ match, another verification step is performed.

In an asymmetric authentication function, ie using a private and a public key, the message authentication code is checked MAC ₁₀₁ using the sender's public key.

In accordance with the further checking step, the subscriber applies 102 in an analogous way to generating the mapping function f 'on the data blocks m ₁ , ..., _mn to a check-target date m _Σ102 to obtain.

Is the target date m _Σ101 shortened before sending, also shortens the participant 102 the calculated inspection target date m _Σ102 in the same way.

Vote the calculated target date m _Σ102 and the received target date m _Σ101 match, the data blocks m ₁ , ..., _mn further processed. If the verification fails, the data blocks are discarded.

This variant can be implemented on an application layer above the "AUTOSAR RTE" and based on "standard AUTOSAR SecOC".

Received messages may not be processed until all messages have been received m ₁ , ..., _mn the message group and message authentication code were received because all messages are needed to verify authenticity. For example, there are data contents that are regularly sent out at shorter intervals, such as every 10 ms, and other data contents that are regularly sent at longer intervals, such as every 100 ms. Therefore, it makes sense to group messages with the same transmission frequency or the same time interval and apply the described method independently on newsgroups with different transmission frequencies.

The invention enables message authentication with reduced bandwidth requirements, especially in comparison to "AUTOSAR SecOC". While the bandwidth requirement in "AUTOSAR SecOC" increases linearly with the amount of data transmitted, the invention provides a constant overhead independent of the number of messages to be authenticated. Thus, authentication of a larger number of messages becomes feasible even in systems with short message lengths and limited bandwidth, such as CAN.

Claims (19)

Method for sending at least two data blocks authenticated using a key (m ₁ , m _n ), wherein an mapping function (f, f) is applied to the at least two data blocks (m ₁ , m _n ) to obtain a target date (m _Σ , m _Σ101 ), wherein an authentication function (s) is applied to the target date (m _Σ , m _Σ101 ) to obtain an authenticator (MAC ₁₀₁ ), wherein the authentication function (s) receives the key, the at least two Data blocks (m ₁ , m _n ) are each sent in separate messages (111, 112) and the authenticator is sent in a message (113). Method according to Claim 1 in that the authenticator (MAC ₁₀₁ ) is sent separately from the at least two data blocks in a message or together with one of the at least two data blocks in a message. Method according to Claim 1 or 2 in which the target date (m _Σ , m _Σ101 ) is shortened before the authentication function (s) is used. Method according to one of the preceding claims, wherein additionally the target date (m _Σ101 ) is sent in a message (113). Method according to Claim 4 in which the authenticator (MAC ₁₀₁ ) is sent together with the target date (m _Σ101 ) in a message (113). Method according to Claim 4 or 5 in which the target date (m _Σ , m _Σ101 ) is shortened before sending. Method according to one of the preceding claims, wherein the mapping function (f, f) has a concatenation function (f) and / or a scatter function (f). Method according to one of the preceding claims, wherein an actual value is additionally entered into the authentication function (f, f). Method according to Claim 8 , where the actuality value is sent in a message. Method for checking at least two data blocks (m ₁ , m _n ) authenticated using a key, the at least two data blocks (m ₁ , m _n ) and an authenticator being received (MAC ₁₀₁ ), the at least two data blocks (m ₁ , m _n ) are received in separate messages (111, 112), wherein a mapping function (f, f) is applied to the at least two data blocks (m ₁ , m _n ) to obtain a check target date (m _Σ , m _Σ102 ) wherein an authentication function (s) is applied to the _check target date (m _Σ , m _Σ102 ) to obtain a check authenticator (MAC ₁₀₂ ), wherein the authentication function (s) receives the key, the received one Authenticator (MAC ₁₀₁ ) and the test authenticator (MAC ₁₀₂ ) are compared, wherein the at least two data blocks are recognized as valid when the received authenticator and the test authenticator match. Method according to Claim 10 where the check target date is truncated before using the authentication function (s). Method for checking at least two data blocks authenticated using a key (m ₁ , m _n ), wherein the at least two data blocks (m ₁ , m _n ), a target date (m _Σ101 ) and an authenticator (MAC ₁₀₁ ) are received, the at least two data blocks (m ₁ , m _n ) being received in separate messages (111, 112) whereby the target date (m _Σ101 ) is checked on the basis of the authenticator (MAC ₁₀₁ ), whereby the at least two data blocks are recognized as invalid if the target date is not recognized as valid. Method according to Claim 12 wherein an mapping function (f) is applied to the at least two data blocks (m ₁ , m _n ) to obtain a _check target date (m _Σ102 ), wherein the received target date (m _Σ101 ) and the _check target date (m _Σ102 ), wherein the at least two data blocks are recognized as valid if the received target date and the check target date match. Method according to Claim 13 wherein the check target date is truncated before the comparison with the received target date. Method according to one of the preceding claims, wherein the messages CAN messages are CAN-FD messages or FlexRay messages or Ethernet messages. Arithmetic unit (101) adapted to perform a method according to any one of the preceding claims. Communication network (100) with at least one subscriber, as the arithmetic unit (101) according to Claim 16 is trained. Computer program that causes a computing unit, a method according to one of Claims 1 to 15 when executed on the computing unit. Machine-readable storage medium with a computer program stored thereon Claim 18 ,

Images